CVE-2026-13221 Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk

CVE-2026-35611 Addressable has a Regular Expression Denial of Service in Addressable templates

CVE-2026-33671 Picomatch has a ReDoS vulnerability via extglob quantifiers

Secrets are Rare not Random